feat: interactive browser login (OAuth2 authorization code flow)

[burnedikt]

What

Adds an innoactive-portal auth command group so users can authenticate interactively via the browser instead of manually obtaining and exporting an access token.

auth login runs the OAuth2 authorization code flow with PKCE:

1. Generates a PKCE code_verifier/code_challenge (S256) and a random state.
2. Opens the browser to Portal's /oauth/authorize/.
3. Catches the redirect on a local loopback server (http://localhost:8723/callback by default).
4. Validates state, then exchanges the code at /oauth/token/.
5. Persists the access token to ~/.config/innoactive-portal/credentials.json (mode 0600, honoring XDG_CONFIG_HOME).

Supports both public clients (PKCE only) and confidential clients (client secret sent via HTTP Basic).

Also adds auth logout (clears stored credentials) and auth status (shows current login + token expiry).

Configuring the OAuth client

Each setting resolves with precedence CLI flag → env var → config file → default:

• Env vars: PORTAL_BACKEND_CLIENT_ID, PORTAL_BACKEND_CLIENT_SECRET, PORTAL_BACKEND_REDIRECT_URI, PORTAL_BACKEND_OAUTH_SCOPE
• Config file: ~/.config/innoactive-portal/config.json (client_id, client_secret, redirect_uri, scope)

With either configured, innoactive-portal auth login needs no arguments.

How existing commands benefit

utils.get_bearer_authorization_header() now falls back to the stored token when PORTAL_BACKEND_ACCESS_TOKEN is unset, so every existing command works after a single login. Explicit env vars still take precedence.

Notes for reviewers

• Endpoints (/oauth/authorize/, /oauth/token/) target Django OAuth Toolkit, relative to PORTAL_BACKEND_ENDPOINT.
• The default redirect URI (http://localhost:8723/callback) must be registered on the OAuth client in Portal, or the flow fails — override via --redirect-uri/env/config.

Testing

• 21 new tests in tests/test_auth.py (PKCE, URL building, token exchange for public/confidential clients, credential persistence, settings-resolution precedence, full login flow incl. state-mismatch + error handling, header fallback).
• Full suite: 30 passed; ruff clean on changed files.

🤖 Generated with Claude Code